[
https://issues.apache.org/jira/browse/CAMEL-26279?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino reassigned CAMEL-26279:
----------------------------------------
Assignee: Andrea Cosentino
> camel-cyberark-vault - verifySsl and certificatePath are ignored, the secret
> version is not encoded, and getSecret copies the secret into a header
> --------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26279
> URL: https://issues.apache.org/jira/browse/CAMEL-26279
> Project: Camel
> Issue Type: Bug
> Reporter: Claus Ibsen
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while adding the catalog body types of cyberark-vault (CAMEL-24961, PR
> #28404).
> h4. 1. verifySsl and certificatePath are ignored
> {{CyberArkVaultConfiguration}} has {{verifySsl}} (default true, line 63) and
> {{certificatePath}} (line 66), but {{ConjurClientImpl}} (main 2a465aa4814c,
> line 57) builds a plain {{HttpClient}} with the default trust of the JVM and
> uses neither. So a Conjur server with a certificate of a private CA cannot be
> used with {{certificatePath}}, and {{verifySsl=false}} does nothing.
> Proposed: build the SSLContext of the client from these options, and mark
> {{verifySsl}} with {{security = "insecure:ssl"}} so the security policy can
> report it.
> h4. 2. The secret version is not encoded
> The {{CamelCyberArkVaultSecretVersion}} header is appended to the URL as
> {{"?version=" + version}} (line 83) without encoding.
> Proposed: URL-encode it.
> h4. 3. getSecret copies the secret value into a header
> {{CyberArkVaultProducer}} (line 70) sets the secret both as the body and in
> the {{CamelCyberArkVaultSecretValue}} header. The header then travels with
> the message, and a later createSecret in the same exchange writes that header
> value instead of its body (CAMEL-26256 item).
> Proposed: set the secret only as the body, with an entry in the upgrade guide.
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
